diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3a949e3bfc65a..fdc020ee9a034 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.95.2](https://github.com/aws/aws-cdk/compare/v1.95.1...v1.95.2) (2021-03-30)
+
+* upgrade `netmask` dependency to address [CVE-2021-28918](https://github.com/advisories/GHSA-pch5-whg9-qr2r) ([#13874](https://github.com/aws/aws-cdk/pull/13874)) ([08de262](https://github.com/aws/aws-cdk/commit/08de26210e2a0f3a104da4afa42e8478f2d7d171))
+  
 ## [1.95.1](https://github.com/aws/aws-cdk/compare/v1.95.0...v1.95.1) (2021-03-25)
 
 
diff --git a/version.v1.json b/version.v1.json
index cf4c9c13cf1bc..80981e652a8d5 100644
--- a/version.v1.json
+++ b/version.v1.json
@@ -1,3 +1,3 @@
 {
-  "version": "1.95.1"
+  "version": "1.95.2"
 }